A Workspace Administrator has full administrative control within their assigned Workspace. They manage users, groups, partners, folders, automations, remote servers, syncs, notifications, event routing, security keys, and data governance settings, all within the boundary of their Workspace.

The role gives a team, department, or project lead self-service control over a complete set of resources without involving the Site Administrator for day-to-day work. If you're choosing between Workspace Administrator and another admin role, see Comparing Workspace Administrators to Related Admin Roles at the bottom of this page.

What Workspace Administrators Can Manage

Workspace Administrators manage all resources within their Workspace on a self-service basis. They do not need to involve the Site Administrator for day-to-day operations.

User Management

Workspace Administrators handle the full user lifecycle within their Workspace: creating individual users, bulk creating users through CSV import, resetting passwords, disabling and re-enabling accounts, offboarding users, setting access expiration dates, configuring protocol privileges, managing IP whitelists, and creating user lifecycle rules to automatically disable or delete inactive accounts.

Group Management

Workspace Administrators create groups, update group memberships, and assign Group Admins within the Workspace.

Partner Management

Workspace Administrators onboard and offboard Partners, create and manage partner users, designate Partner Admins, and configure Partner Admin settings to control what Partner Admins can do within their Partner organization.

Folder and File Management

Workspace Administrators create folder structures and assign and manage folder permissions for users, groups, and partners. They designate Folder Admins for specific folders and apply folder settings for folders within their Workspace.

Data Governance

Workspace Administrators configure data governance policies within their Workspace through the Data Governance section. The following capabilities are available.

Data Retention

File Expiration: automatically remove folder contents after a specified period.
Archive Removed Files: archive files when they are removed rather than permanently deleting them.

Data Restrictions

File Extension Limits: restrict uploads to specified file extensions on a folder.
File Name Length Limits: limit the length of uploaded file names.
File Name Regex Limits: restrict file names to a regular expression pattern.
Folder Locks: prevent changes to the folder structure.
Watermark Previews: apply watermarks to file previews.

Organization

Organize Files: automatically move uploaded files into subfolders based on rules.
Automatically Create New User Folders Here When Users Are Created: automatically create a personal folder for each user.
Metadata Categories: define custom metadata fields for files and folders.

Storage Regions

Storage Regions: assign a storage region to specific folders within the Workspace. Region selection is recursive.

Restore

Restore Files and Folders: restore deleted files and folders within the Workspace.
Restore Users: restore deleted users within the Workspace.

Automations and Integrations

Workspace Administrators create and manage automations, remote servers, remote server mounts, and syncs. They can configure these only on folders within their Workspace. They cannot create automations, syncs, or mounts on folders outside their current Workspace.

Workspace Administrators create and manage share links, configure share link permissions and expiration, create inboxes for receiving files from external parties, set up share groups, create custom forms, and configure public hosting for Workspace folders.

Encryption

SFTP/SSH Keys

Workspace Administrators create and manage SFTP/SSH keys for Workspace users, revoke keys, and configure SFTP/SSH Key Lifecycle Rules to automatically expire or rotate keys on a schedule.

GPG

Workspace Administrators manage GPG keys in the GPG Key Manager for use with folder-level encryption and decryption. They configure GPG Encryption, GPG Decryption, and GPG Recryption as folder settings within their Workspace, and set GPG Key Lifecycle Rules to expire or rotate GPG keys automatically.

AS2

Workspace Administrators create and manage AS2 identities, configure AS2 trading partners, and manage AS2 certificates for Workspace-level B2B file exchanges.

Notifications

Workspace Administrators create and manage email notifications, webhooks, Amazon SNS notifications, Google Pub/Sub notifications, Slack notifications, and Microsoft Teams notifications for events within the Workspace.

Event Channels

Workspace Administrators create and manage Event Channels Targets, Subscriptions, and Channels within their Workspace. They can view Events and Delivery Attempts scoped to their Workspace.

What Workspace Administrators Cannot Manage

Workspace Administrators do not have access to anything outside their Workspace. The following remain under the exclusive control of Site Administrators:

Site-wide security and protocol settings, including FTP, SFTP, and WebDAV configuration, ciphers, host keys, certificates, and 2FA requirements.
Authentication, including SSO provider integrations and site-wide authentication configuration.
Monitoring and logging, including SIEM integrations, site-level logs, and usage reporting.
Billing and site administration, including billing, Workspace creation, child site creation, and clickwraps.
Site customization and infrastructure, including custom domains, site branding, custom SMTP, and all other site-level customization.
File integrity, including checksum and file integrity settings.

Workspace Administrators coordinate with the Site Administrator when they need changes to anything above. Common examples include troubleshooting failures that require access to site-level logs, updating 2FA requirements, configuring SSO, setting up SIEM integrations, adjusting protocol settings, and creating new Workspaces.

Delegating Administration Within a Workspace

Workspace Administrators can further delegate administration within their Workspace by assigning existing admin roles to Workspace users. Folder Admins manage folder settings and permissions for specific folders within the Workspace. Group Admins manage users within their assigned group inside the Workspace, drawing on whichever user-management capabilities the Site Administrator has enabled site-wide (create, add/remove existing users, edit, enable/disable, delete, set and reset passwords, and exempt from User Lifecycle Rules). Partner Admins manage users within their Partner organization inside the Workspace.

Delegation lets the Workspace Administrator distribute onboarding, offboarding, and day-to-day management responsibilities across their team without giving every user full Workspace administration.

The Workspace Administrator role fills a gap between existing administrative roles.

The Site Administrator can manage everything on the site, which is too broad for a team, department, or project lead.

The Folder Admin can manage a single folder's settings and permissions, which is too narrow for someone who needs to manage users, partners, and integrations.

The Group Admin can create users within their group but cannot manage them after creation.

The Partner Admin can manage users within their Partner organization but cannot manage folders, automations, or integrations.

The Workspace Administrator provides full operational control over a complete set of resources, scoped to a single Workspace.